exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Aoop CMS 0.3.6 SQL Injection / Cross Site Scripting

Aoop CMS 0.3.6 SQL Injection / Cross Site Scripting
Posted Aug 25, 2012
Authored by Julien Ahrens

Aoop CMS version 0.3.6 suffers from cross site scripting and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, xss, sql injection
SHA-256 | 7e543732ca411d58df4bf7efa3788a00659b4a6763765dbc770b4af139d338a7

Aoop CMS 0.3.6 SQL Injection / Cross Site Scripting

Change Mirror Download
Inshell Security Advisory
http://www.inshell.net


1. ADVISORY INFORMATION
-----------------------
Product: Aoop CMS
Vendor URL: www.annonyme.de
Type: Cross-site Scripting [CWE-79], SQL-Injection [CWE-89]
Date found: 2012-04-07
Date published: 2012-08-24
CVSSv2 Score: 7,5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) (highest)
CVE: -


2. CREDITS
----------
The vulnerabilities were discovered and researched by Julien Ahrens from
Inshell Security.


3. VERSIONS AFFECTED
--------------------
Aoop CMS v0.3.6, older versions may be affected too.


4. VULNERABILITY DESCRIPTION
----------------------------
Aoop CMS v0.3.6 is affected by multiple SQL-Injection and Cross-Site
Scripting vulnerabilites.


## SQL-Injection Vulnerabilities ##

Pre-Auth:
http://localhost/index.php?print=download&page=Photos&sub=loadAndShowPhoto&picId=[SQLi]

Post-Auth:
http://localhost/index.php?page=users&sub=readMessage&msgId=[SQLi]
http://localhost/index.php?page=users&sub=newMessage&messageId=[SQLi]
http://localhost/index.php?page=users&sub=deleteMessage&messageId=[SQLi]
http://localhost/index.php?page=EProjects&sub=editRFC&rfcId=[SQLi]&projectId=18

Due to improper input - validation of these GET parameters, an attacker
could inject own arbitrary SQL statements without or with required
authentication. Successful exploitation of these vulnerabilities could
result in a complete database / web-application compromise or data theft.


## Cross-Site Scripting Vulnerabilities ##

Non-Persistent (GET):
http://localhost/index.php?page=Photos&sub=search&pattern="><script>alert(String.fromCharCode(88,83,83))</script>

Non-Persistent (POST):
http://localhost/index.php?page=Photos&sub=search (Field:
"Pattern",payload="><script>alert(1)</script>)

Due to improper input - validation of these GET/POST parameters, an
attacker could temporarily inject arbitrary code using required user
interaction into the context of the website/current browser session.
Successful exploitation of these vulnerabilities allows for example
session hijacking or client side context manipulation.


Persistent:
http://localhost/index.php?page=users&sub=extendUserProfile (Field:
"profileItemName", "profileItemValue">
http://localhost/index.php?page=EProjects&sub=viewProject&projectId=18
(Field: "name","official_link")
http://localhost/index.php?page=Photos&sub=uploadPic (Field: "Title")

Due to improper input - validation of these input fields, an attacker
could permanently inject arbitrary code using an own registered
user-account into the context of the website. Successful exploitation of
these vulnerabilities allows for example session hijacking or server
side context manipulation.


5. PROOF-OF-CONCEPT (CODE / Exploit)
------------------------------------
For further screenshots and/or PoCs visit:
http://security.inshell.net/advisory/23


6. SOLUTION
-----------
Update to v0.4 RC3


7. REPORT TIMELINE
------------------
2012-04-07: Initial notification sent to vendor
2012-04-08: Vendor Response / Feedback
2012-07-29: Vendor releases v0.4 RC3 which fixes the vulnerabilities
2012-08-24: Coordinated public release of advisory


8. REFERENCES
-------------
http://security.inshell.net
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close